Baidu introduced Apollo World, an AI simulation system that generates up to 100,000 kilometres of virtual driving daily, equivalent to about three years of real-world testing with a safety driver. Baidu is using it to train and validate Apollo Go robotaxi strategies for international operations, though the company says road testing remains necessary. The system produces real-time camera images and LiDAR point clouds for interactive virtual traffic environments.
Waymo has opened preliminary talks with local officials about bringing driverless taxi service to Raleigh and Durham, North Carolina, though no partners or launch dates were named. Policy adviser Rich Harrington disclosed the discussions at the N.C. DOT Transportation Summit, noting Charlotte remains the company's planned North Carolina debut. The move signals Waymo's widening expansion ambitions in the Research Triangle beyond its announced Charlotte entry.
A House of Commons Business, Innovation and Trade Committee report warned that connected vehicles from Chinese manufacturers could be accessed, monitored, or remotely disabled, and urged the UK government to tighten oversight of data transmitted between vehicles and overseas companies. The report focuses on internet-connected cameras, microphones, sensors, and remote update channels in exported vehicles. It signals a regulatory push toward supply-chain scrutiny and data-flow controls for connected cars sold in the UK.
A Tesla Model X operating in Autopilot crashed on the Pennsylvania Turnpike, hitting a guard rail and crossing into oncoming lanes, with both occupants surviving. The crash occurred less than a week after NHTSA opened an inquiry into a fatal Autopilot crash. The second incident intensifies scrutiny of Tesla's semi-autonomous system and regulatory oversight of ADAS deployment.
Spain's UNE published a standardization report on cybersecurity for connected and automated mobility, intended as a baseline for future standards work covering cooperative intelligent transport systems and vehicle-to-environment connectivity. The document consolidates input from sector experts and companies and responds to a rise in automotive cyberattacks exploiting vehicles' growing number of networked digital components. It is a standards and governance development rather than a specific vulnerability disclosure. The implication is that Spanish and EU stakeholders gain a reference framework to align future connected-vehicle security requirements.
EU lawmakers are pressing the bloc to assess the security threat posed by BYD vehicles, citing concerns over data access and remote connectivity. BYD responded that no information from its vehicles can be remotely accessed from China and that customers retain control of their data. The push reflects widening scrutiny of Chinese-connected vehicle software and telematics in European markets. The outcome could shape future market access and regulatory conditions for Chinese OEMs selling into the EU.
Security researchers Charlie Miller and Chris Valasek demonstrated remote wireless takeover of Jeep Cherokee vehicles, letting an attacker from miles away control the radio, horn, and transmission through an internet-connected head unit. The technique affected thousands of Fiat Chrysler vehicles and became the template for modern automotive remote attack research. The work exposed how telematics and infotainment connectivity can bridge into safety-critical systems, forcing the industry to rethink network segmentation and over-the-air update security.
Affected Vehicle Make & Model
Fiat Chrysler
Jeep, Cherokee
Observed MITRE ATT&CK techniques
T1210 Exploitation of Remote Services
Global Automotive Cyber Incidents/Eventsinformational
The FBI and NHTSA issued a safety bulletin warning carmakers and owners that connected vehicles are increasingly vulnerable to hacking, nearly a year after the Jeep Cherokee exploit that triggered a 1.4 million vehicle recall. The joint warning urges awareness of cybersecurity threats tied to connected vehicle technologies. The bulletin underscores regulatory pressure on automakers to harden vehicle software security.
Cybersecurity researcher Nir Yehoshua disclosed a critical security weakness in charging stations from an international electric vehicle manufacturer, rated 9.8 out of 10 severity. The flaw could allow attackers to remotely take over charging stations, endangering drivers and causing damage. The manufacturer has reportedly deployed a fix, but owners are urged to update charging station firmware as soon as possible. The disclosure adds to a growing pattern of EV charging infrastructure security risks.
Volkswagen received approval to test SAE Level 3 autonomous driving on public roads in Hefei, China, targeting production readiness by 2027, while Xpeng is trialing a Level 4 robotaxi service in Guangzhou covering booking, fleet management and passenger operations. The moves show both automakers deepening AV development in China, though separate regulatory approvals would be required before either technology could reach Europe.
Kodiak AI delivered the first two Western Star 49X trucks equipped with its Kodiak Driver autonomous system to Atlas Energy Solutions in September, part of an initial order of 100 driverless trucks. The two additions bring Atlas's owned-and-operated driverless fleet to 37 trucks, which operate with no human in the cab and had surpassed 40,000 cumulative driving hours as of June 30. Kodiak plans to complete the 65 remaining Western Star deliveries in the first half of 2027, scaling driverless freight in the Permian Basin.
Affected Vehicle Make & Model
Western Star, 49X
Global Automotive Cyber Incidents/Eventsmedium
🕸️ Ransomware Detected: Five Star Plating targeted by thegentlemen
Five Star Plating is targeted by thegentlemen.Victim Description: fivestarplating.com Five Star Plating LLC is an American electroplating and metal finishing company founded in 2007 in Little Rock, Arkansas, with 82 employees and approximately 12.5 million dollars in annual revenue. It operates 3 automatic plating lines plus 1 manual rack line across two facilities, coating around 50 million parts per year. Its core offerings include zinc and zinc alloy plating, phosphate coatings, E-Coat electrocoating and specialty finishes like zinc-nickel as a cadmium replacement for aerospace and defense. The company serves automotive, oil and gas, construction, aerospace and military clients with ISO 9001 certification and salt spray testing capabilities up to 1,000 hours. Key strengths are full-spectrum plating from mass barrel to custom rack work, a dedicated testing laboratory and strategic location in central Arkansas. It is the largest specialized plater in the state with continued growth of 16 percent year over year.Victim’s Country: USDiscovered: 05 Nov 2026, 14:07 SGT
Known TTPs associated with The Gentlemen
T1021.002 SMB/Windows Admin SharesT1047 Windows Management InstrumentationT1053.005 Scheduled TaskT1486 Data Encrypted for ImpactT1685 Disable or Modify Tools
Actor-profile intelligence; not confirmed in this individual incident, but included in heatmap count.
Global Automotive Cyber Incidents/Eventsmedium
🕸️ Ransomware Detected: HighTec targeted by thegentlemen
HighTec is targeted by thegentlemen.Victim Description: hightec.ch HighTec AG is a Swiss industrial engineering company founded in 1988 in Winterthur, specializing in turnkey surface treatment systems including painting booths, powder coating lines, air filtration and drying systems. With 50 to 100 employees, it designs, manufactures, installs and maintains coating solutions for automotive, aerospace, furniture and metal fabrication industries. Its product range covers dry filter and water wash booths, cartridge filter systems, ATEX explosion-proof solutions, electrostatic coating and energy-efficient drying ovens. The company emphasizes Swiss quality engineering with VOC compliance, waste heat recovery and digital monitoring. Key strengths are 38 years of experience, full turnkey delivery from concept to commissioning and ATEX-certified hazardous environment systems. It competes with Dürr and Nordson while offering personalized Swiss engineering and local European support.Victim’s Country: CHDiscovered: 05 Nov 2026, 14:06 SGT
Known TTPs associated with The Gentlemen
T1021.002 SMB/Windows Admin SharesT1047 Windows Management InstrumentationT1053.005 Scheduled TaskT1486 Data Encrypted for ImpactT1685 Disable or Modify Tools
Actor-profile intelligence; not confirmed in this individual incident, but included in heatmap count.
Global Automotive Cyber Incidents/Eventsmedium
🕸️ Ransomware Detected: Mitsubishi Motors Ukraine targeted by thegentlemen
Mitsubishi Motors Ukraine is targeted by thegentlemen.Victim Description: itsubishi-motors.com.ua Mitsubishi Motors Ukraine is the official importer and distributor of Mitsubishi Motors vehicles in Ukraine, managing sales, service and parts through over 20 authorized dealers nationwide. Its model range includes the Outlander and Outlander PHEV crossover, Eclipse Cross, ASX and the legendary L200 pickup truck. As part of the Renault-Nissan-Mitsubishi Alliance, it benefits from global R&D, shared platforms and a 5-year warranty. The Ukrainian automotive market recovered to around 60,000 new car sales in 2025, with Mitsubishi holding a 3 to 5 percent share led by Outlander and L200. Services span new and certified pre-owned sales, original parts, financing through partner banks and full after-sales support. Strategic initiatives include expanding the PHEV hybrid lineup and preparing for fully electric model launches.Victim’s Country: UADiscovered: 05 Nov 2026, 14:04 SGT
Known TTPs associated with The Gentlemen
T1021.002 SMB/Windows Admin SharesT1047 Windows Management InstrumentationT1053.005 Scheduled TaskT1486 Data Encrypted for ImpactT1685 Disable or Modify Tools
Actor-profile intelligence; not confirmed in this individual incident, but included in heatmap count.
Global Automotive Cyber Incidents/Eventsmedium
🕸️ Ransomware Detected: European Motorcars targeted by thegentlemen
European Motorcars is targeted by thegentlemen.Victim Description: european-motorcars.com European Motorcars is a multi-brand premium European car dealership founded in 1972 in Dayton, Ohio, with 54 years of experience selling and servicing Mercedes-Benz, BMW, Audi, Porsche, Land Rover, Jaguar, Volvo and MINI. With 50 to 100 employees across two locations on Miamisburg-Centerville Road and Dorothy Lane in Kettering, it offers new and certified pre-owned vehicles, official service centers with brand-specific diagnostic equipment and an in-house body shop. The dealership provides full-cycle services including financing, insurance, trade-in and professional detailing. It stands out as one of the few multi-brand premium European dealers in the region, allowing customers to compare and service multiple brands under one roof. Key strengths are 54 years of local trust, certified technician teams for each brand and original parts inventory. It serves the greater Dayton metropolitan area of approximately 800,000 people.Victim’s Country: DEDiscovered: 05 Nov 2026, 14:04 SGT
Known TTPs associated with The Gentlemen
T1021.002 SMB/Windows Admin SharesT1047 Windows Management InstrumentationT1053.005 Scheduled TaskT1486 Data Encrypted for ImpactT1685 Disable or Modify Tools
Actor-profile intelligence; not confirmed in this individual incident, but included in heatmap count.
Global Automotive Cyber Incidents/Eventsmedium
🕸️ Ransomware Detected: Customs Support targeted by thegentlemen
Customs Support is targeted by thegentlemen.Victim Description: customssupport.com Revenue $389.4 Million IZD GmbH Europe's largest customs brokerage network, founded with headquarters in the Netherlands and operating 50 plus offices across 14 countries with over 1,600 employees. Its German subsidiary IZD GmbH is based in Duisburg, Europe's largest inland port, providing 24/7 customs clearance for automotive, electronics, pharmaceutical and e-commerce clients. Services cover import and export clearance, transit procedures, tariff classification, bonded warehousing, AEO certification and export controls. The group is backed by European private equity fund Castik Capital and serves over 5,000 clients. Its digital platform at customssupport.com offers EDI integration, real-time tracking and customs data analytics. Estimated group revenue is 300 to 500 million euro with recent additions including Brexit advisory and preferential trade consulting.Victim’s Country: GBDiscovered: 05 Nov 2026, 14:03 SGT
Known TTPs associated with The Gentlemen
T1021.002 SMB/Windows Admin SharesT1047 Windows Management InstrumentationT1053.005 Scheduled TaskT1486 Data Encrypted for ImpactT1685 Disable or Modify Tools
Actor-profile intelligence; not confirmed in this individual incident, but included in heatmap count.
May Mobility is deploying its autonomous robotaxis at U.S. Army bases in partnership with Forterra through the ROADS challenge. The controlled military environment lets both companies demonstrate that autonomous fleets can operate cost-effectively in daily use. The partnership expands May Mobility's operational footprint beyond public roads into defense logistics.
BYD and MOGOX unveiled an 8.5-metre right-hand-drive Level 4 autonomous bus at the SUMW 2026 event. The vehicle targets right-hand-drive markets for driverless public transit, signaling Chinese autonomous bus suppliers are positioning hardware for export to markets such as the UK, Australia and Southeast Asia.
Turkey's KVKK data protection authority published a data breach notification for Vava Cars Turkey Otomotiv A.S. after attackers gained unauthorised access to a chat file held by a data processor. The breach involves 8,268 chat records containing names, phone numbers and other personal data of customers and prospective customers, with the total number affected still undetermined. An investigation is ongoing. The case highlights third-party processor risk and Turkish regulatory reporting obligations for automotive retailers.
Seoul Metropolitan Council data shows 27 autonomous vehicle crashes in the year from October 2025 to September 2026, exceeding the 26 crashes recorded over roughly three years from December 2022 to September 2025. Total crashes reached 53, with Cheonggyecheon accounting for 19 and city buses for 33. Fault remains unconfirmed in 18 cases, 11 of them unresolved for over a year, prompting calls for effective safety measures.
South Korea's Ministry of National Defense launched a survey of connected-car technology sold in the country and is weighing tiered restrictions on China-made connected vehicles entering military facilities. The assessment follows a National Assembly audit warning that such vehicles could transmit video, location, and other data collected inside military sites to external servers. The probe extends automotive cybersecurity into national security and supply-chain risk, potentially affecting market access for Chinese OEMs. Access standards for military facilities are expected to be defined based on the survey results.
Affected Vehicle Make & Model
BYD
Global Automotive Cyber Incidents/Eventsinformational
Researchers at Gothenburg University and Chalmers University of Technology found numerous security holes in third-party apps, websites, and cloud services connected to vehicles, shifting risk beyond automaker-built apps. Music and entertainment apps in particular open attack paths for hackers into vehicle systems. The findings affect connected car owners broadly and expand the automotive attack surface to external software vendors. The research implies automakers must vet third-party integrations, not just their own software.
The Detroit News reported roughly two dozen Tesla Cybercabs operating from a Tesla collision-repair facility in Southfield, Michigan, during fall 2026 testing on roads including I-696, M-10, Telegraph and Eight Mile. The test vehicles carried drivers using temporary steering wheels, and no Detroit passenger-service timeline was given for Tesla or Waymo. The reported testing signals Tesla expanding Cybercab validation beyond its initial Austin and California deployments into a new metro market.
Uber delayed the commercial launch of its robotaxi service with Nuro and Lucid in the San Francisco Bay Area to Q1 2027, superseding plans to launch later this year. CEO Dara Khosrowshahi said the service will run fully driverless from day one rather than starting with supervised trips, with fully driverless testing expected to begin this quarter. The delay signals the operational and regulatory complexity of launching driverless ride-hailing at commercial scale.
Owners of Li Auto SUVs imported into Russia report attackers seizing their master accounts via recycled Chinese eSIMs from resellers like eSender, re-issuing digital keys and locking doors until payment. The attacks exploit an identity model built for the Chinese market that breaks down when vehicles are exported. The incident exposes cybersecurity risks in connected vehicles reliant on regional eSIM infrastructure.